IMPORTANT CHANGES TO HOW WE HANDLE YOUR PERSONAL MEDICAL DATA
Are you aware that your personal medical information that you share with your GP or other
healthcare professional is to be extracted and stored on a computer outside of the control
of this practice and that the practice will have no control of who has access to that
information?
Purpose of this leaflet
There are changes occurring that make it a legal obligation for us to share your information
(see below). The proposed benefits of sharing identifiable data are to help to plan and
monitor effective patient services, especially where patients receive care from several
different organisations.
We feel it is vital that you as our patient are made aware of these changes. This leaflet has
been produced to help you understand what currently happens to information you share
with your health professional and how that information may be used outside of your direct
care.
Problems that you discuss with your GP are usually of a personal nature and you expect that
the information will remain confidential. This confidentiality is central to the trust between
healthcare professionals and you as our patient. Without this confidentiality, you may be
reluctant to disclose information of a personal nature that we may need to help provide you
with the best possible healthcare.
What we record about you
Healthcare professionals in our practice record information about the care we provide. The
type of information that is recorded includes the following;
•
•
•
•
•
Demographics, e.g. address, telephone number, e-mail, date of birth, gender, etc.
What you tell us when you see us in consultations e.g. about your physical and
psychological health and social circumstances
Diagnoses, investigations, treatments, referrals, family background
Social information e.g. housing status, alcohol, smoking data
Third party sources e.g. hospital letters, A&E attendances, relatives, carers,
insurance companies, solicitors.
What we already share about you:
We share different types of information about our patients. These include:
•
•
•
•
•
•
•
Personal information about you and your illness, when needed for your
direct care, e.g. referral to hospital consultants, district nurses, health visitors,
midwives, counsellors, the summary care record
Patient identifiable information to public health, in order to arrange programs for
childhood immunisations, communicable diseases, cervical smears and retinal
screening
With explicit consent, personal information to other organisations outside the NHS,
e.g. insurance companies, benefits agencies.
Limited information about you, if relevant, to protect you and others, e.g. to social
services child protection investigations
under certain acts of parliament to protect you and others e.g. court order
•
Summary information which is anonymised (cannot identify you) e.g. NHS targets,
medical research and clinical audit.
How we protect your personal information:
Currently, your GP is responsible for protecting your information and to do this they comply
with the Data Protection Act 1998 (DPA). As part of the DPA, all healthcare professionals
have an obligation to only share information on a need to know basis.
The physical storage of information is on secure servers which are protected by firewalls.
Access to the information is by strong authenticated password. The number of people who
have access to your information is limited to members of the practice team and in a few
instances some pre agreed data is shared with other health care professional e.g. District
Nurses but on a need to know basis.
What is changing?
Under the Health and Social Care Act 2012 the Health & Social Care Information Centre
(HSCIC) on behalf of NHS England (the body responsible for commissioning health services
across England) will be able to extract personal and identifiable information about all
patients in England. The programme, called care.data, is administered by the HSCIC using
software and services provided by a private sector company. Once your identifiable
information has been taken from different health
organisations (GP practices , hospitals, mental health trusts) it will then be linked together
to produce a picture of your health care. This information will be stored on national secure
servers and will be managed by HSCIC. Although access to information will be strictly
controlled, the HSCIC is planning to share this information with other organisations both
NHS and private. The HSCIC will decide what information they will share and who they then
share this information with. Your GP will not be able to object to this information being
released to HSCIC and will no longer be able to protect your information under the DPA as
stated above. Effectively, where the HSCIC is concerned the health and social care act overrules the DPA with regard to disclosure of personal information.
What you need to do:
•
•
•
If you are happy for the HSCIC to extract, store and manage/use your personal
information then you need do nothing as the information will be automatically taken
from your GP’s computer systems.
If you don’t wish your information to be extracted then you MUST inform your
practice who will then block the uploading of your identifiable and personal
information to the HSCIC.
If you are happy for your information to be extracted and used by the HSCIC for
anonymised reports but NOT shared by the HSCIC with other agencies or companies
in identifiable format, you can ask your GP practice to add a code to your record
which will alert the HSCIC not to use your information in this way.
An opt out form is included in this leaflet.
It should be emphasised that your access to health care and the care that you receive will
not be affected by your decision.
Further information about care.data
NHS England/HSCIC
Patient information booklet: http://tinyurl.com/cdptinfo
Patient “FAQs”: http://tinyurl.com/cdptfaqs
Web site: http://www.nhs.uk/caredata
medConfidential (Campaign for confidentiality)
Patient leaflet: http://tinyurl.com/mccdinfo
Web site: http://medconfidential.org/
Data Protection Act
Web site: http://tinyurl.com/dpactinfo
Opt-out from secondary use of patient
identifiable data (care.data)
Please would you add the relevant “electronic flags” to my/our medical records in
order to ensure:
Code
☐
that personal confidential information is not uploaded from the GP
record to the Health and Social Care Information Centre (HSCIC)
9Nu0
☐
that personal confidential information gathered from any health and
social care setting is prevented from leaving the HSCIC
9Nu4
I/We understand the implications of this request:




that it will not affect the medical care that I/We receive either from the GP
surgery or from anywhere within the NHS or the private sector
that this refusal does not in any way prohibit the GP surgery from sharing my
medical information with other NHS and private services, where necessary, to
provide effective clinical care
that I/We can change our mind at any time about this refusal
that I/We will inform you if we subsequently decide to opt back into this
system
Please list below the names and DOB of those wishing to opt out:
Name
DOB